File name:

Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.bin.zip

Full analysis: https://app.any.run/tasks/f4bde0f5-4342-44a8-bbc8-1f4c2467bc80
Verdict: Malicious activity
Threats:

Ficker Stealer is a malware that steals passwords, files, credit card details, and other types of sensitive information on Windows systems. It is most often distributed via phishing emails and can perform keylogging, process injection, and browser tracking.

Analysis date: December 25, 2020, 10:11:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
buerloader
evasion
trojan
ficker
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

6EE50F985FD852E0568B691056E27DBB

SHA1:

75A4EC289C640F8898810F0B46233EC7585168A5

SHA256:

25C89F13797842196179947590E0CC617A58BDC86AE27C1C5D88A18495021560

SSDEEP:

3072:il9XwLXgAXhpwxzPhmcaLXWoEBlM9Wdk6lOZpS/puN+75nzmVz:iXwNx6BccQXsy9WvEZo/AN+8Vz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Writes to the hosts file

      • Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe (PID: 772)
    • Application was dropped or rewritten from another process

      • Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe (PID: 772)
      • installer.exe (PID: 2444)
      • installer.exe (PID: 688)
    • BuerLoader was detected

      • installer.exe (PID: 2444)
    • Actions looks like stealing of personal data

      • installer.exe (PID: 688)
    • Steals credentials from Web Browsers

      • installer.exe (PID: 688)
    • FICKER was detected

      • installer.exe (PID: 688)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • installer.exe (PID: 2444)
      • Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe (PID: 772)
    • Creates files in the user directory

      • installer.exe (PID: 2444)
    • Application launched itself

      • installer.exe (PID: 2444)
    • Creates files in the program directory

      • installer.exe (PID: 688)
    • Reads the cookies of Mozilla Firefox

      • installer.exe (PID: 688)
    • Checks for external IP

      • installer.exe (PID: 688)
    • Reads the cookies of Google Chrome

      • installer.exe (PID: 688)
  • INFO

    • Manual execution by user

      • Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe (PID: 772)
      • taskmgr.exe (PID: 3916)
      • NOTEPAD.EXE (PID: 636)
    • Dropped object may contain TOR URL's

      • Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe (PID: 772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 788
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2020:12:25 10:09:17
ZipCRC: 0x969b227d
ZipCompressedSize: 143257
ZipUncompressedSize: 333248
ZipFileName: Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.bin
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
46
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start winrar.exe no specs cyberpunk 2077 (unlocked downloader) [codex] full.exe #BUERLOADER installer.exe taskmgr.exe no specs #FICKER installer.exe notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
636"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\FXSAPIDebugLogFile.txtC:\Windows\system32\NOTEPAD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
688"C:\Users\admin\AppData\Local\Temp\installer.exe"C:\Users\admin\AppData\Local\Temp\installer.exe
installer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
772"C:\Users\admin\Desktop\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe" C:\Users\admin\Desktop\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\cyberpunk 2077 (unlocked downloader) [codex] full.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
1488"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.bin.zip"C:\Program Files\WinRAR\WinRAR.exeexplorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
2444"C:\Users\admin\AppData\Local\Temp\installer.exe"C:\Users\admin\AppData\Local\Temp\installer.exe
Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\installer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3916"C:\Windows\system32\taskmgr.exe" /4C:\Windows\system32\taskmgr.exeexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Task Manager
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
608
Read events
570
Write events
38
Delete events
0

Modification events

(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1488) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.bin.zip
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1488) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
2
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1488WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_1488.43418
MD5:
SHA256:
1488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb1488.43662\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
MD5:
SHA256:
2444installer.exeC:\Users\admin\AppData\Roaming\530354923
MD5:
SHA256:
688installer.exeC:\ProgramData\kaosdma.txttext
MD5:
SHA256:
688installer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\3N0L4GH1.txttext
MD5:
SHA256:
772Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exeC:\Windows\System32\drivers\etc\hoststext
MD5:
SHA256:
1488WinRAR.exeC:\Users\admin\AppData\Local\Temp\Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.bin.zipcompressed
MD5:
SHA256:
772Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exeC:\Users\admin\AppData\Local\Temp\installer.exeexecutable
MD5:
SHA256:
2444installer.exeC:\Users\admin\AppData\Local\Temp\nsfE212.tmp\System.dllexecutable
MD5:FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA256:6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
10
DNS requests
5
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
772
Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
GET
301
162.0.209.225:80
http://brokstrot.com/c.txt
CA
html
235 b
suspicious
GET
200
151.139.128.14:80
http://crl.comodoca.com/AAACertificateServices.crl
US
der
506 b
whitelisted
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEG7AChe%2BLVtylIzsmFEcl7A%3D
US
der
471 b
whitelisted
GET
200
151.139.128.14:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
US
der
727 b
whitelisted
688
installer.exe
GET
200
50.19.252.36:80
http://api.ipify.org/?format=xml
US
text
13 b
shared
772
Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
GET
301
162.0.209.225:80
http://brokstrot.com/blink.php?name=Cyberpunk%202077%20(Unlocked%20Downloader)%20%5BCODEX%5D%20FULL
CA
html
308 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
772
Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
162.0.209.225:80
brokstrot.com
AirComPlus Inc.
CA
suspicious
772
Cyberpunk 2077 (Unlocked Downloader) [CODEX] FULL.exe
162.0.209.225:443
brokstrot.com
AirComPlus Inc.
CA
suspicious
151.139.128.14:80
crl.comodoca.com
Highwinds Network Group, Inc.
US
suspicious
688
installer.exe
85.17.190.28:80
LeaseWeb Netherlands B.V.
NL
malicious
688
installer.exe
50.19.252.36:80
api.ipify.org
Amazon.com, Inc.
US
malicious

DNS requests

Domain
IP
Reputation
brokstrot.com
  • 162.0.209.225
suspicious
crl.comodoca.com
  • 151.139.128.14
whitelisted
ocsp.usertrust.com
  • 151.139.128.14
whitelisted
ocsp.sectigo.com
  • 151.139.128.14
whitelisted
api.ipify.org
  • 50.19.252.36
  • 54.225.220.115
  • 54.225.66.103
  • 54.221.253.252
  • 54.235.83.248
  • 54.225.169.28
  • 23.21.126.66
  • 23.21.42.25
shared

Threats

PID
Process
Class
Message
688
installer.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup (ipify .org)
688
installer.exe
A Network Trojan was detected
ET TROJAN Win32/Ficker Stealer Activity M3
688
installer.exe
A Network Trojan was detected
STEALER [PTsecurity] Ficker
688
installer.exe
A Network Trojan was detected
ET TROJAN Win32/Ficker Stealer Activity M3
688
installer.exe
A Network Trojan was detected
STEALER [PTsecurity] Ficker
No debug info